---
title: Tip: GitHub's 2026 Actions changes don't stop script injection or artifact poisoning. Pass untrusted input through env vars and never run downloaded artifacts in privileged jobs | ctxsec
url: https://ctxsec.com/items/tip-github-actions-pwn-request-script-injection-artifacts
description: ""
status: "guidance (Wiz Research, Oct 26)"
published: 2026-10-26
---

> 

[← Tips & Guides](/tips) · [markdown](/items/tip-github-actions-pwn-request-script-injection-artifacts.md)

guidance (Wiz Research, Oct 26)

2026-10-26

### Tip: GitHub's 2026 Actions changes don't stop script injection or artifact poisoning. Pass untrusted input through env vars and never run downloaded artifacts in privileged jobs

Wiz's Oct 26 review of what still works against GitHub Actions makes two points worth checking in your workflows today:

- **Script injection needs no checkout.** A `pull_request_target` step like `run: echo "${{ github.event.pull_request.title }}"` runs an attacker's PR title as shell code, with the job's secrets. Move the value into `env:` (for example `PR_TITLE: ${{ github.event.pull_request.title }}`) and use `"$PR_TITLE"`, quoted, in the script.
- **Artifacts are still a bridge.** An unprivileged `pull_request` build can upload attacker-made output that a privileged `workflow_run` job downloads and executes. Checkout hardening doesn't help, because nothing is checked out. Treat artifacts from fork-triggered runs as untrusted data: don't execute them, and don't give that job deploy secrets.

Quick audit: grep workflows for `${{ github.event.` inside `run:` blocks, and for `workflow_run` jobs that call `download-artifact` and then run a script.

Sources: [Wiz: The Pwn Request reckoning, what still works against GitHub Actions (Oct 26)](https://www.wiz.io/blog/github-actions-security-pwn-request-reckoning)